South Korea Probes Major Cyberattack on Diplomatic Academy Amid Espionage Concerns

South Korea has launched an investigation into a major cyberattack targeting the Korea National Diplomatic Academy (KNDA), after officials disclosed that a significant amount of data may have been exposed in what authorities suspect could be a foreign espionage operation.

South Korea’s Foreign Ministry said the academy’s online education system was compromised after hackers exploited a previously unknown zero day software vulnerability, allowing them to gain access to the system for several months before the intrusion was detected.

The ministry said the breach was first identified in early February after a government cybersecurity agency detected suspicious activity on the system. Investigators believe the attackers gained control of the server between April and May 2025 and maintained access until the system was shut down in February 2026. Officials said the compromised server stored online training materials and personal information, including the names and user IDs of trainees.

Foreign Ministry spokesperson Park Il said authorities are working with cybersecurity agencies to determine the full extent of the breach. While investigators have not yet identified those responsible, the government has not ruled out the involvement of foreign state-backed hacking groups, including possible links to North Korea. No evidence has emerged so far that the leaked information has been misused.

The Korea National Diplomatic Academy is responsible for training South Korean diplomats, foreign service candidates and senior government officials before overseas postings, making it a potentially valuable target for espionage. Local media reported that the breach may have affected information relating to thousands of current and former diplomatic personnel.

Officials said the compromised online training platform remains offline while forensic investigations continue. The Foreign Ministry added that it is strengthening cybersecurity measures across its systems and reviewing procedures to prevent similar incidents in the future.